Elastic Defend high stable eql

Unusual Privilege Escalation to System

Identifies the execution of a process as the SYSTEM account from a parent process not running as SYSTEM. This behavior is consistent with a successful exploit to escalate privileges and create a process with SYSTEM privileges.

View Source

Detection Logic

sequence with maxspan=5m
 [process where event.action == "start" and user.id like ("S-1-5-21*", "S-1-12-*")] by process.entity_id
 [process where event.action == "start" and
  process.Ext.token.integrity_level_name == "system" and user.id == "S-1-5-18" and
  process.Ext.effective_parent.name != null and
  process.parent.Ext.real.pid == null and
  not process.executable :
            ("?:\\Windows\\System32\\wermgr.exe",
             "?:\\Windows\\System32\\WerFault.exe",
             "?:\\Windows\\SysWOW64\\WerFault.exe",
             "?:\\Windows\\System32\\WerFaultSecure.exe",
             "?:\\Windows\\System32\\wbem\\WmiPrvSE.exe",
             "?:\\Windows\\SoftwareDistribution\\Download\\Install\\securityhealthsetup.exe") and
  not (process.name : "rundll32.exe" and
       process.args : ("?:\\windows\\system32\\davclnt.dll,DavSetCookie", "?:\\Windows\\SysWOW64\\davclnt.dll,DavSetCookie") and
       process.parent.executable : ("?:\\Windows\\System32\\svchost.exe", "?:\\Windows\\SysWOW64\\svchost.exe")) and

  not (process.code_signature.subject_name : "Secure By Design Inc." and process.code_signature.trusted == true)

  ] by process.parent.entity_id

Field Validations

Loading…

Comments (0)

Loading comments...